ICO's Wood: GDPR grace period? No way

If you were hoping EU regulators are feeling generous ahead of GDPR enforcement, you're out of luck. Information Commissioner's Office Head of International Strategy & Intelligence Steve Wood made that clear in his keynote at the IAPP's Data Protection Intensive in London on Wednesday.

"Will there be a grace period? No. You will not hear talk of grace periods from people at the ICO. That's not part of our regulatory strategy," he said. "What you will see is a common-sense, pragmatic approach to regulatory principals."

The ICO will focus on risk, he said, adding it's happy to work with organizations if there's an area that seems a little shady or unclear. But grace period? No.

The ICO's main focuses will be on transparency, control and accountability. To that end, it is currently facilitating a public consultation on consent guidance, which opened March 2 and ends March 31. Wood said the ICO is focused on whether data controllers are giving individuals real choice and control, and organizations "need to focus on situations where you have a power imbalance. Is consent a pre-condition of using a service? Is that a fair way of obtaining consent?" He added consent mechanisms have to be prominent, concise, granular, easy to understand, and cannot be bundled into one big, rubber-stamp package.

"You can't dress something up as consent if it's not consent," he said. "The GDPR clearly sharpens the focus of consent as a tool for giving individuals control over their personal data. It shouldn't be consent if it's not really the correct basis, and you shouldn't give illusory consent to individuals," he said.

And he means it: "Data protection authorities across Europe will be asking penetrating questions about records of consent ... Looking very much at how organizations got the record, who has consented, when they consented ... what they were told, mechanisms for withdrawing."

They want records they can audit.

Organizations also need to be thinking about and documenting how that consent will be obtained, whether it's a tick-box, a physical signature, or whichever method makes most sense.

On the accountability front, Wood said organizations will thrive when and if accountability is embedded organization-wide and a range of people take responsibility for different parts of the process.

"If we come knocking on the door, if we investigate or conduct an audit in an organization, the best way you can demonstrate to us that we won't need to delve deeper and you've got covered all the compliance issues is to have a comprehensive accountability program, to be able to to take us through the different steps you've taken to address compliance issues," he said.

"If we come knocking on the door, if we investigate or conduct an audit in an organization, the best way you can demonstrate to us that we won't need to delve deeper and you've got covered all the compliance issues is to have a comprehensive accountability program." — Steve Wood, ICO

For guidance, Wood pointed to the privacy notices code published on the ICO's website late last year, which aims to help organizations seeking advice on how to meet standard GDPR requirements, including how to produce clear and accessible information, just-in-time notices, and how information can be layered while still "providing all the information an individual needs, not just in one big monolithic policy."

Wood was clear that transparency on big data, artificial intelligence and machine learning is complicated under the GDPR. The ICO released an updated big data report, initially released in 2014, last week, which found there is a combination of both technical and organization approaches organizations should take working in the big data context.

"It's about how big data can work for the individual. How can you explain it in simple terms, what the impact or the implications are of an algorithm." It's not like you're going to try to explain the math to the data subject, but you can explain what happens as a result.

In the future, Wood can see codes and certifications incentivizing companies to demonstrate accountability, but that's not likely to happen by next year's GDPR deadline.

As far as organizations looking to stay off the regulators' radars, be it the ICO or another DPA, Wood said the answer is simple:

"The key thing to do is invest now, convince people in your organization why data protection is important for trust."

Comments

Related Stories

In this episode of The Privacy Advisor Podcast, Chris Zoladz, CIPP/E, CIPP/G, CIPP/US, CIPM, CIPT, of Navigate talks about what he’s seeing on the ground as he advises clients who’re aiming to comply with the GDPR as its effective date rapidly approaches. Zoladz says based on his experience, organiz...

On Jan. 24, ESOMAR, a market-research association, hosted its first European Insights Summit to celebrate the value of research and launch a transparency initiative called Research Choices, an online platform informing the public about online audience measurement research and offering a central repo...

The IAPP's certification department has released a newly revised European-focused certification exam to include the changing General Data Protection regulation, as well as other European-focused privacy updates. Certification Director Doug Forman said that when the GDPR was announced in December 201...

In a blog post, 2 March, the U.K. Information Commissioner's Office released its first specific GDPR implementation guidance, focusing on consent, for public consultation. The ICO will accept feedback through 31 March. The draft guidance is extensive, focusing on how consent requirements in the GDPR...

The IAPP is the largest and most comprehensive global information privacy community and resource. Founded in 2000, the IAPP is a not-for-profit organization that helps define, support and improve the privacy profession globally.

The IAPP is the only place you’ll find a comprehensive body of resources, knowledge and experts to help you navigate the complex landscape of today’s data-driven world. We offer individual, corporate and group memberships, and all members have access to an extensive array of benefits.